ignore __pycache__
actually use config["database"]
admin.is_auth() in its natural habitat
various cleanups